Privacy
Contractual (“Contractual,” “we,” “us”) provides software that helps business customers define, approve, run, and verify AI workflows.
Contractual Technologies, Inc. is being formed; this notice operates under the Contractual name until formation completes. The formed entity name will replace the operating name here without changing the substance of this notice unless we say otherwise.
Contact: hello@contractual.tech.
This notice covers the marketing site, the authenticated product application, and ordinary business correspondence about AI Workflow Reviews and related services.
Contractual is built for business customers. When a customer organization invites users, that organization generally acts as the controller of workspace content, and Contractual processes that content to provide the service.
What we hold depends on how you use Contractual. Most of it you hand us directly or create inside a workspace:
Running the service produces essential technical logs: request metadata, error logs, and operational telemetry needed to run and secure the service.
The marketing site does not load analytics, advertising, or marketing pixels, so we do not build a picture of you from your browsing.
Customers control which business systems they connect, which information they share, and which actions they approve. Those systems remain under the control of the customer or its vendors.
Information reaching Contractual from a connected system arrives because the customer approved that connection for that purpose. For production integrations, Contractual uses only the approved connection and permitted actions. We do not own or control customer records outside Contractual.
The product uses essential authentication and session cookies required to keep you signed in and protect account access. The marketing site does not currently load analytics, advertising, or marketing pixels.
Because we do not currently use non-essential trackers, we do not show a cookie-consent banner. If we later introduce non-essential trackers, we will update this section and any required consent mechanism before enabling them.
Service delivery and operations. We authenticate users, provide and improve the product, test workflow rules, confirm completed work, maintain audit records, and communicate about the service.
Security and integrity. We use account data and technical logs to protect accounts, investigate misuse, and keep the service running as intended.
Legal. We use information to meet legal obligations and to establish, exercise, or defend legal claims.
We do not sell personal information. We do not use workspace case content for unrelated advertising, and we do not run interest-based advertising.
We share information in these situations, and outside a written agreement that says otherwise we do not share it at all:
We use infrastructure providers to operate the service. Today that includes Railway for application runtime, Neon for Postgres and authentication, and GitHub for source control and CI. Production partner data is not intentionally stored in the repository.
For supervised browser execution in the private preview, Contractual uses Browserbase to run isolated browser sessions. Those sessions can process the business-system content a customer chooses to include in that supervised work; customer production authority remains disabled until a written agreement enables it.
Contractual does not send your work to an AI provider of ours. The application makes no AI calls of its own today. Where a customer’s own AI is used, it runs under that customer’s existing agreement with their provider. If that changes, we will update this notice.
We retain account and workspace data while the workspace is active and as needed for security, dispute, and legal retention needs. In setting how long that is, we weigh how sensitive the information is, what we collected it for, whether we can still serve that purpose without it, and what the law requires. The product supports evidence export.
A documented self-service deletion workflow and partner-specific automated retention policy are not yet fully implemented. High-touch customers should agree retention, deletion, residency, backup, and export requirements with us before transferring non-public production data.
We apply access controls, transport encryption, and integrity checks to the data we hold. No method of transmission or storage is perfectly secure.
Please do not send us sensitive personal information — government identifiers, financial account numbers, payment credentials, health information, or the special categories European law protects — through the product or in correspondence. The service is not built to receive it.
Contractual operates from the United States, and our providers process data in the regions they operate. Using the service from outside the United States means your information is processed there.
We have not put a standing cross-border transfer framework in place. Customer-specific residency commitments and transfer terms, if any, will be set in a written agreement, and customers sending personal data from Europe should settle those terms with us first.
Workspace administrators control membership and connected systems. For access, correction, export, or deletion requests, contact hello@contractual.tech. We may need to verify the request and coordinate with the customer organization that owns the workspace.
If we cannot act on a request, we will tell you why.
Several U.S. states give residents rights over personal information. Which rights you have depends on where you live, and some carry limits and exceptions we may have to apply.
Where your state law grants it, you can ask what personal information we hold and where it came from, ask for a copy, ask us to correct it, and ask us to delete it. Write to hello@contractual.tech. We may need to verify who you are first, and where the information sits in a customer workspace we will coordinate with the organization that controls it. If we turn a request down, you can ask us to reconsider.
Three answers are the same in every state: we do not sell personal information, we do not share it for targeted or cross-context behavioral advertising, and we run no advertising on our sites. Exercising any of these rights costs you nothing and changes nothing about the service you get.
This section applies if you are in the United Kingdom or the European Economic Area.
Roles. When a customer organization puts workspace content into Contractual, that organization is generally the controller of it and Contractual is the processor acting on its instructions. For what we handle in our own right — account records, our correspondence with you, AI Workflow Review requests, and the technical logs that keep the service running — Contractual is the controller.
Legal bases. We process account and workspace information to perform the agreement with you or your organization. We process technical logs and security records under our legitimate interest in keeping the service working and safe. We process information to comply with law where the law requires it. Where we ever rely on consent, you can withdraw it at any time.
Your rights. You can ask us for access to your personal information, correction of it, deletion of it, a machine-readable copy of it, or a restriction on how we process it, and you can object to processing we base on legitimate interests. Write to hello@contractual.tech. If our answer does not satisfy you, you can complain to the data protection authority where you live.
Transfers. Contractual operates from the United States, which European authorities have not found to give personal information protection equivalent to European law. As set out above, we have not put a standing transfer mechanism in place; transfer terms belong in a written agreement and should be settled before personal data is sent.
We have not appointed an Article 27 representative in the EU or the UK, and we have not appointed a data protection officer. If either becomes required of us, we will appoint one and name them here.
Contractual is a business product. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, write to hello@contractual.tech and we will deal with it.
Our pages link to services we do not run, including scheduling tools, our providers’ own sites, and the business systems a customer connects. We do not control them and we are not responsible for what they do with information. Their own privacy notices govern their handling, not this one.
We may update this notice as the product or legal entity details change. The effective date above will change when we do. Material changes affecting customer processing should also be communicated through the ordinary customer channel when appropriate.
Email hello@contractual.tech with any question about this notice or any request under it.
We do not publish a postal address yet. When the entity is formed, its registered address will be added here.